qmd-search

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads approximately 318 MB of AI models (including embedding, reranking, and query expansion models) to the local directory ~/.cache/qmd/models when first executed.
  • [COMMAND_EXECUTION]: The wrapper script qmd-search.sh executes local system binaries including qmd and rg (ripgrep) to perform search operations and manage the local index.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves and displays content from user-controlled markdown files.
  • Ingestion points: Search results and file content retrieved via the qmd CLI are provided directly to the agent's context.
  • Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions when presenting retrieved markdown content to the agent.
  • Capability inventory: The skill allows the agent to read local files and execute complex search queries across the indexed vault.
  • Sanitization: The skill does not perform sanitization or filtering of the text content found within the markdown files before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 10:20 PM
Security Audit — agent-trust-hub — qmd-search